Defensive check against unexpected commit points

[mhofman]

What is the Problem Being Solved?

For our hangover inconsistency protection, cosmic-swingset currently saves the current block height just before committing the swing-store. While we believe it's impossible for the swing-store to commit at any other point, in #8423 we observe symptoms that indicate a partial block execution was committed and used in a restart. We would like a mechanism that detects such situations early, and fail fast.

Description of the Design

Store 2 block heights instead of 1 in the host section of the swing-store:

• a "begin height" updated when cosmic-swingset receives "begin block".
• a "end height" updated when cosmic-swingset completed "end block". (the current saved blockHeight)

blockNeedsExecution would continue to check the "end block" value to determine if we are in an hangover case or not

"begin height" would be checked after a new check of blockNeedsExecution in "begin block", and determined we're not experiencing hangover. If the saved "begin height" is found to be the same as the new block height, fail (or possible if found to be different than newBlockHeight - 1).

Additionally we likely should check that the "end block" blockHeight is the same as the "begin block" blockHeight.

Security Considerations

Adds check to catch inconsistent state early instead of relying of cosmos state checks.

Scaling Considerations

None

Test Plan

TBD

Upgrade Considerations

This requires a consensus software upgrade. The import-kernel-db logic also needs to be updated to restore this new persisted host state.